#!/bin/sh
# ForestVPN's part of the router's network configuration (PRD INS-3, ADR 0108 section 2.6): an unmanaged interface for the
# tunnel device. The firewall zone `forestvpn` and its forwarding are the kill switch's (render, WP A-2) and exist only
# while protection is on (seam S3). Nothing routes into the tunnel until the wizard sets protect, and `wan` and `lan` are
# never edited (PRD R-15).
# Idempotent: runs once after the install and again after an upgrade, and only adds what is missing. What it added is
# recorded in forestvpn.main.added so that `/etc/init.d/forestvpn uninstall` takes out exactly that.
#
# Upgrade from the two-schema package (seam S2): its `forestvpn.settings` section becomes `forestvpn.main` (mode off ->
# protect 0; chosen/all -> protect 1 and that mode; `list device` -> `config device` sections routed into the tunnel),
# and the zone and forwarding it had added are taken out again (render adds the one zone when protection is on).
uci -q get forestvpn.main >/dev/null || uci set forestvpn.main=forestvpn
if uci -q get forestvpn.settings >/dev/null; then
	for o in enabled platform wan killswitch updates added mtu; do
		v=$(uci -q get "forestvpn.settings.$o") && uci set "forestvpn.main.$o=$v"
	done
	case $(uci -q get forestvpn.settings.mode) in
		chosen | all) uci set forestvpn.main.protect=1; uci set "forestvpn.main.mode=$(uci -q get forestvpn.settings.mode)" ;;
		*) uci set forestvpn.main.protect=0 ;;
	esac
	for m in $(uci -q get forestvpn.settings.device); do
		m=$(echo "$m" | tr 'A-F' 'a-f')
		s=dev_$(echo "$m" | tr -cd '0-9a-f')
		uci set "forestvpn.$s=device"; uci set "forestvpn.$s.mac=$m"; uci set "forestvpn.$s.route=tunnel"
	done
	uci delete forestvpn.settings
fi
# opkg's copy of the shipped defaults, dropped beside the conffile on every upgrade of a configured router (opkg compares
# the live file with the old package's md5): a stale UCI package of its own. `routing` and the rest are read with defaults.
rm -f /etc/config/forestvpn-opkg
for o in protect mode killswitch; do
	uci -q get "forestvpn.main.$o" >/dev/null || case $o in protect) uci set forestvpn.main.protect=0 ;; mode) uci set forestvpn.main.mode=all ;; killswitch) uci set forestvpn.main.killswitch=standard ;; esac
done
added=$(uci -q get forestvpn.main.added)
case " $added " in *" zone "*) uci -q delete firewall.forestvpn ;; esac
case " $added " in *" forwarding "*) uci -q delete firewall.forestvpn_lan ;; esac
added=$(echo " $added " | sed 's/ zone / /; s/ forwarding / /; s/^ *//; s/ *$//')
add() { case " $added " in *" $1 "*) ;; *) added="${added:+$added }$1" ;; esac; }

uci -q get network.forestvpn >/dev/null || {
	uci set network.forestvpn=interface
	uci set network.forestvpn.proto=none
	uci set network.forestvpn.device=fvpn0
	add network
}
uci set forestvpn.main.added="$added"
# a legacy (Lua-only) LuCI gets ForestVPN's pages and the interface's ifname alias; a modern one nothing (luci-legacy says why)
/usr/libexec/forestvpn/luci-legacy link
uci commit network; uci commit firewall; uci commit forestvpn
# a running router applies it now; at first boot the services start after this script anyway
[ -z "$IPKG_INSTROOT" ] && [ -x /sbin/reload_config ] && [ -d /var/run/ubus ] && /sbin/reload_config
exit 0
